What Is DNSTT? DNS Tunneling in NPV Tunnel Explained Simply

Among NPV Tunnel's protocol list, DNSTT is the odd one out. It is not fast and it is not pretty, but when it is needed it can be the only thing that works.

The idea in plain English

Every time you open a website, your phone asks a DNS server "where is this name?" Because DNS is so basic, networks almost always allow it, even networks that block everything else. DNSTT takes advantage of that: it chops your data into small pieces, hides them inside DNS questions, and lets a special DNS server (run by whoever owns the tunnel) hide the replies in its answers.

How dnstt works

The open-source dnstt tool encodes traffic into DNS queries and responses. It can send those over plain UDP DNS, DNS over HTTPS (DoH) or DNS over TLS (DoT). It uses KCP and smux for reliability, so lost packets are retransmitted and several streams can share one tunnel. The tunnel's content is encrypted and the server is authenticated by a public key, so a resolver in the middle cannot read it.

Why is it slow?

DNS was designed for short, independent lookups, not for continuous streams. Each tiny message has to pass through resolvers and caches, and every byte costs round trips. There is no universal speed. It depends on the resolver and record types. Expect something good enough for messaging and light browsing, not for video.

When it makes sense

• A captive portal or restricted network where only DNS gets through.
• Emergency access during severe network restrictions.
• When every other protocol has been blocked and you just need text-level connectivity.

What you need

You cannot use DNSTT with an ordinary server. The server side needs a domain with a delegated name server, the dnstt server software and a public key. If a provider offers DNSTT, they will give you the domain, the public key and often a resolver address to type into the config. NPV Tunnel's store listing includes DNSTT as a supported option.

Tips if you try it

1. Try several resolvers. Some are faster than others from your network.
2. Prefer DoH or DoT if the network inspects plain DNS.
3. Be patient with the first connection; the handshake can take a while.
4. Keep your usage light: text and messaging, not downloads.

Back to the overview: supported protocols.

A closer look at the packets

A normal DNS question might be "what is the address of example.com?". A tunnelled one looks like a long, strange hostname such as aGVsbG8gd29ybGQ.t.example.net, where the first part is your data encoded to fit DNS rules. A recursive resolver forwards it to the authoritative name server for t.example.net, which happens to be the tunnel server. The answer comes back in a record such as TXT, carrying data in the opposite direction.

Because each query can only carry a small payload (DNS names are limited in length), a single web page may take dozens or hundreds of round trips. That is why speed is measured in tens of kilobits per second rather than megabits.

DoH and DoT make it stealthier

When the tunnel uses DNS over HTTPS or DNS over TLS, the network sees an encrypted connection to a public resolver rather than suspicious DNS queries. This is more resistant to simple DNS inspection and often a bit faster than plain UDP because it uses a persistent connection.

Tuning tips

• Pick a resolver close to you and test several.
• Keep to text-based apps. Disable auto-updates and video autoplay while on DNSTT.
• Lower the number of simultaneous connections; the tunnel is a narrow pipe.
• Use it as the last entry of a connection group so other protocols are tried first.

Security and responsible use

The dnstt project encrypts and authenticates the tunnel with a public key, but the technique itself is widely used by attackers to hide malware traffic, so managed networks frequently alert on it. Use it only on networks where you have permission.

Frequently asked questions

Keep reading